# CVE-2026-0603: Hibernate ORM second-order SQL injection in InlineIdsOrClauseBuilder

Source: https://junglewise.ai/threats/cve-2026-0603-hibernate-orm-second-order-sql-injection-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-23. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-0603 · Severity: high · CVSS 8.3 · Published 2026-01-23

A security vulnerability has been identified in Hibernate, a widely used tool for managing database data in Java applications. An attacker with low-level access could use specially crafted input to manipulate database queries, potentially allowing them to view sensitive files, modify or delete data, or cause the application to crash. This could lead to significant data breaches or service outages for organizations using affected versions of Red Hat JBoss and other enterprise platforms.

Technologies: [org.hibernate:hibernate-core (Maven)](https://junglewise.ai/threats/technologies/org-hibernate-hibernate-core), [Red Hat AMQ Broker](https://junglewise.ai/threats/technologies/amq-broker). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-0603 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-0603 being exploited in the wild.

**How severe is CVE-2026-0603?** High severity, with a CVSS score of 8.3, published 23 January 2026.

**Which products and versions are affected?** Hibernate ORM 5.3.38-1.Final and earlier versions used in Red Hat JBoss EAP 7.4.24; org.hibernate:hibernate-core (Maven) >= 5.2.8, <= 5.6.15, ECOSYSTEM:introduced=5.2.8,last_affected=5.6.15.

**Is there a fix for CVE-2026-0603?** A patch was published on 2026-03-18: Red Hat released security advisories and patches for JBoss EAP 7.4.24 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-0603 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-0603?** Check whether you run Hibernate ORM, org.hibernate:hibernate-core (Maven) or Red Hat AMQ Broker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A second-order SQL injection vulnerability exists in Hibernate ORM's InlineIdsOrClauseBuilder. The flaw is triggered when the application processes unsanitized non-alphanumeric characters provided in the ID column. A remote attacker with low privileges can exploit this by injecting malicious SQL fragments that are later executed by the database engine. Successful exploitation can lead to unauthorized sensitive information disclosure (including reading system files via database functions), data manipulation, or data deletion, potentially resulting in an application-level denial of service. Red Hat has released security updates (e.g., RHSA-2026:4915) for JBoss EAP and related products to address this issue.

## Affected products

- Hibernate Hibernate ORM 5.3.38-1.Final and earlier versions used in Red Hat JBoss EAP 7.4.24
- Red Hat JBoss Enterprise Application Platform 7.4.24
- Red Hat AMQ Broker 7
- Red Hat Fuse 7
- Red Hat Process Automation 7
- Red Hat Single Sign-On 7

## Identifiers

- CVE-2026-0603
- GHSA-2p5w-cvg5-gc5c

## Timeline

- 2026-01-23: disclosed: CVE published
- 2026-03-18: patched: Red Hat released security advisories and patches for JBoss EAP 7.4.24

## References

- [https://github.com/hibernate/hibernate-orm](https://github.com/hibernate/hibernate-orm)
- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/jbossnetwork/restricted/listSoftware.html](https://access.redhat.com/jbossnetwork/restricted/listSoftware.html)
- [https://access.redhat.com/errata/RHSA-2026:4915](https://access.redhat.com/errata/RHSA-2026:4915)
- [https://access.redhat.com/errata/RHSA-2026:4916](https://access.redhat.com/errata/RHSA-2026:4916)
- [https://access.redhat.com/errata/RHSA-2026:4917](https://access.redhat.com/errata/RHSA-2026:4917)
- [https://access.redhat.com/errata/RHSA-2026:4924](https://access.redhat.com/errata/RHSA-2026:4924)

## Related threats

- [Netty request smuggling via chunked extension quoted-string parsing](https://junglewise.ai/threats/cve-2026-33870-netty-request-smuggling-via-chunked-extension-quoted-string)
- [Apache ZooKeeper sensitive information disclosure in ZKConfig log output](https://junglewise.ai/threats/cve-2026-24308-apache-zookeeper-sensitive-information-disclosure-in-zkconfig-log)
- [Apache ZooKeeper hostname verification bypass in ZKTrustManager](https://junglewise.ai/threats/cve-2026-24281-apache-zookeeper-hostname-verification-bypass-in-zktrustmanager)
- [SQL Injection in Hibernate ORM](https://junglewise.ai/threats/cve-2019-14900-sql-injection-in-hibernate-orm)
- [SQL injection in hibernate-core](https://junglewise.ai/threats/cve-2020-25638-sql-injection-in-hibernate-core)